Why not a national ID card?

[Hercules Rockefeller]

The US Mint is secure?

Errrrmmm... You do know where the US Mint gets all the supplies they need to make money from, don't you? Same place that Iraq, Iran and North Korea do...
http://www.fas.org/sgp/crs/row/RL33324.pdf


In the real world, if the value if worth the effort and risk, it's going to be stolen.

I assumed it was secure. Then how about as secure as the current chip manufacturers? I haven't heard of a single chip being stolen from them?

 

[Hercules Rockefeller]

.
Unless of course it's the Chinese government setting up the chip duplicating system.
There's so much faux stuff coming from there the gummint has to be involved.

You don't think they're capable of making fake US documents now?

 

[marplots]

Is the reason we have financial/identity fraud now, merely the dearth of biometric scanners and databases?

Or is it greed, politics and so forth?

Because there is no logical basis to suppose that more of the former will overcome the latter.

I don't know. I assume there are transactions where the risk of fraud is lessened somehow. Why do I trust the 100 dollar bill you've given me?

 

[marplots]

You don't think they're capable of making fake US documents now?

If they are, then that wouldn't change with a national ID. That would remain an unsolved problem.

 

[Bob001]

You don't think they're capable of making fake US documents now?

Again, it's not the quality of the document that makes it secure. It's linking it to a secure database that will confirm it's validity, like U.S. passports and passport cards. You might be able to make a fake passport and show it to buy booze or get on a plane, but you can't use it to cross the border because the scanner linked to the database will reject it. In an ideal world, you wouldn't need a document at all. A thumbprint or retinal scan would be enough to confirm your ID if it was connected to a secure database.

 

[I Ratant]

You don't think they're capable of making fake US documents now?

.
Of course they do!

 

[crimresearch]

I don't know. I assume there are transactions where the risk of fraud is lessened somehow. Why do I trust the 100 dollar bill you've given me?

You shouldn't. You should trust the $1, because it isn't worth it to make a convincing bill in such low denominations.

It's a balancing act... or an equation if you prefer.

Perceived risk and effort required, against perceived value of item and level of security.

Raise one of those abnormally high, and the others will shift correspondingly.

 

[Trakar]

But there would be no reason to have, and a lot of reasons NOT to have, a common database. A secure ID would simply confirm that you are who you say you are, and harder for someone else to claim that they are you. It wouldn't provide any additional information.

The existence and promotion of such a card would result in many of the forms of ID I have now being taken out of use and superceded, effectively forcing me to adopt and join such a system or basically face not being able to function within normal society. I prefer not to be a part of such a society.

You give up your Social Security number for all kinds of transactions,

No, I do not.

but your doctor's office, the DMV, your credit cards, the credit bureaus, your bank, your landlord, your employer, your insurance companies, your phone company etc. all maintain separate databases.

and they all have their seperate account and personal ID information and why would I want one number to identify me to all of these seperate services and vendors?

They can't communicate with each other.

What makes you say this?

There's no reason to think a secure ID would cause that to change, and privacy laws could be toughened if they needed to be.

What color is the sky in your world?

For the folks who are chiming in from Sweden, Germany and other countries that use national IDs, how does it work there, how do you get your card, what do you use it for, and what kinds of problems have you or others experienced?

What makes you think that what is acceptable and perhaps even functional in Sweden or Germany, would be acceptable and considered reasonable in the US?

 

[Trakar]

No. They managed to get information from it. The didn't make a fake card.

Actually, they are staging a man-in-the-middle attack which uses a stolen card and defeats the ID PIN verification system in the connecting terminal by making it think any four digit PIN entered is the correct card verified PIN and simultaneously fools the card into not even recognizing that a PIN verification has been attempted. For now this means a potential bit of money ran up on bad plastic. When these cards represent people's lives, its not worth the "convenience."

 

[Andrew Wiggin]

.
Unless of course it's the Chinese government setting up the chip duplicating system.
There's so much faux stuff coming from there the gummint has to be involved.

You don't even need to duplicate the chip. You just buy a tray of unmounted microcontroller chips, etch a metal contact plate to duplicate what the real one looks like, mount the chip on the back under a blob of epoxy, and then program the microcontroller to emulate the responses you'd get from the real chip. If it needs a fingerprint, you don't even need the real fingerprint, you just need to break the code it uses to describe fingerprints, and then input a code that describes your own, or a jelly print from someone else if you don't want to use your own. Right now the hacker community has consumer electronics dissected down to chip level and the operating systems 'jailbroken' within days of release. There's no reason to think that a chip-based ID would be any different; it might take a day or two longer for criminals to steal enough of them to dissect and analyze.

 

[Andrew Wiggin]

.
A private citizen was able to track the movements of his favorite author by following his debit card useage.
A private citizen!
It's that easy!
(And found the author in the CA aqueduct, where he'd been for a couple of years.)

This sounds like a story I'd enjoy reading. Do you have a link?

 

[Andrew Wiggin]

I don't know. I assume there are transactions where the risk of fraud is lessened somehow. Why do I trust the 100 dollar bill you've given me?

If you don't, ask me to give you small bills. IIRC anything smaller than a 20 isn't currently profitable to counterfeit. If my 100 is legit, I can take it into a bank and come back with ten tens, twenty fives, or even one hundred sagagewea dollars. I won't bother trying to come back with fifty two's; most of the young kids think those are counterfeit anyway. If it isn't legit, or I think it's too much hassle, then I won't come back. Either way we both win.

 

[The Don]

Please bear in mind that all of the following relates to the introduction of ID cards in the UK by the UK authorities.

I've been in Sweden for 12 years and I've never been stopped by the police and asked for my national ID for no reason and never met anyone else who has either.

If ID cards were introduced in the UK then as a white, middle-aged, middle-class male who tends to be out and about between 0600 and 2200 then I'd wouldn't expect to be "carded" either. If I was a black, middle-Eastern or Pakistani youth who was out and about at night then I'd expect to be "carded" regularly.

The stated objectives for the ID card is to reduce the risk of terrorism and to address issues of illegal immigration. "Carding" black, middle-Eastern or Pakistani youths could be claimed to be a legitimate tactic in addressing these objectives. The UK Police have demonstrated by their use of the SUS laws that they apply them to disproportionately target these groups.

Come to think of it, though we all have national ID numbers used for everything, there isn't any requirement to have your ID on your person at all times, or even have one.

The stated objectives for the ID card is to reduce the risk of terrorism and to address issues of illegal immigration. The only way this could work is to compel people to carry their card and to give the Police the ability to stop and enquire. Otherwise the person could just fail to turn up at a police station to present their ID.

This thread seems to come with the assumption that if you have a national ID card then everyone *has* to have one and *has* to carry it all the time.

In my case it was to address the particular reasons proposed for the introduction of the UK ID card, to reduce the risk of terrorism and to address illegal immigrants. This can only work if carrying the card is mandatory.

Why is that assumed?

it is assumed because of the stated aims of the ID card system. If these were to change, then there'd be no need to carry the card.

 

[epepke]

A national ID would be fantastic, as long as the government database was secure and only available to the right people, and RFID chips with elaborate encryption were provided. We could even make them into fashion accessories. Gold stars and pink triangles.

 

[icerat]

In my case it was to address the particular reasons proposed for the introduction of the UK ID card, to reduce the risk of terrorism and to address illegal immigrants. This can only work if carrying the card is mandatory.

I disagree. I think being unable to open bank accounts, buy property, sign contracts, go to school, get medical help etc etc would contribute to reducing the risk of terrorism and illegal immigrants - and indeed identifying the latter - without any requirement that people carry them at all times.

There's often a delay and problems when you first immigrate to Sweden in getting your "person number" and ID cards. Life in that limbo is a nightmare - and that's for legal immigrants, and it's got nothing to do with profiling.

 

[richardm]

Edit: I see quite a lot of this has already been addressed, but I've written it now so hey

I'll take that bet. Credit cards with chips haver never been forged as far as I know.

Forged entirely from scratch is difficult, but cloning an existing chip is pretty straightforward. If you remain below the limit where a card will phone home then the chances of detection are pretty small, because most shops will authenticate the card statically (i.e. the card authenticates itself).

It is of course possible that ID cards will always phone home when asked to authenticate, which would thwart that, but that system's more expensive. Credit card issuers can deal with that by making a charge for the service - how will that work for ID cards, I wonder?

The other issue is that the main difficulty in forging from scratch is not that it's impossible per se but that it's going to be rather expensive in terms of time and money to figure out how to do it, and there are much easier and cheaper ways of scamming money off a credit card. So nobody's bothered.

It may well be that a national ID card system might be worth expending a bit of effort on to forge from scratch, but in any case a copy of somebody else's ID might be enough to do whatever it is you want to do.

Do you have an example of a faked card being used?

http://www.guardian.co.uk/technology/2008/jan/03/hitechcrime.news

Fraudsters withdrew £2,100 from his account at ATMs, even though he was in possession of his card
...
"The disputed transactions were made using the chip in the issued card received by Mr Reddell and not a counterfeit card," says Barclaycard, adding that the Ombudsman had upheld its decision to dismiss Mr Reddell's claim.
"That couldn't have happened, because it was kept in my safe," contends Reddell. He only ever used it in an ATM to change the pin on the card, which was new, two weeks before the frauds occurred.

Incidentally this guy took Halifax (whose ATMs they were) to court to get his £2100 back, but the judge dismissed his claims, essentially believing the bank when it claimed that it was impossible to counterfeit a card.

Details of the ruling.

Dunno if Hercules Rockefeller is a judge?

Edit: I think I've conflated two different instances of suspected card fakery there, but the effect is much the same.

 

[The Don]

I disagree. I think being unable to open bank accounts, buy property, sign contracts, go to school, get medical help etc etc would contribute to reducing the risk of terrorism and illegal immigrants - and indeed identifying the latter - without any requirement that people carry them at all times.

There's often a delay and problems when you first immigrate to Sweden in getting your "person number" and ID cards. Life in that limbo is a nightmare - and that's for legal immigrants, and it's got nothing to do with profiling.

Even without an ID card, illegal immigrants find some of those things difficult (getting medical help is the exception) and consequently live in a "grey" society which is cash-based. Having a single ID card wouldn't change this a jot.

Needing to carry the card has been repeatedly mentioned by the people proposing its introduction in the UK as a key element of enforcement.

 

[psionl0]

A national ID would be fantastic, as long as the government database was secure and only available to the right people, and RFID chips with elaborate encryption were provided.

That's the problem. The national databases would be accessible to anybody who could hack into them. And with all an individual's details available from within a single ID, the information for hackers would be priceless.

 

[Hercules Rockefeller]

That's the problem. The national databases would be accessible to anybody who could hack into them. And with all an individual's details available from within a single ID, the information for hackers would be priceless.

Again, there's not a single incident of any bank databases in Denmark being hacked, ever! It's virtually impossible to do so.

 

[The Don]

Again, there's not a single incident of any bank databases in Denmark being hacked, ever! It's virtually impossible to do so.

Here in the UK, large quantities of government held data is routinely misplaced. Here is a list covering 18 months:

http://en.wikipedia.org/wiki/List_of_UK_government_data_losses

This is why we're not too confident